200-201 Question 94
Select 3An online retail company is conducting a security review of its e-commerce platform. During the review, the team identifies several aspects of its system, such as exposed APIs, outdated software versions, and weak password policies. Which of the following correctly differentiates elements of the attack surface and vulnerabilities in this context?
- A
The publicly exposed APIs are part of the attack surface because they represent entry points that attackers can target.
- B
Outdated software versions are part of the attack surface because they represent all the potential ways an attacker can exploit the system.
- C
Weak password policies are vulnerabilities because they are specific weaknesses that can be exploited by attackers.
- D
Outdated software versions are vulnerabilities because they are specific issues that can be exploited within the attack surface.
Show answer and explanation
Correct answers: A, C, D
Explanation
The attack surface encompasses all the potential entry points or areas in a system that attackers can use to gain unauthorized access, such as exposed APIs. Vulnerabilities, on the other hand, are specific weaknesses within the attack surface, such as outdated software versions or weak password policies. Correctly distinguishing between these concepts is critical for effective cybersecurity operations.
- A. Correct.
Correct - Publicly exposed APIs are part of the attack surface as they represent entry points or areas that attackers can target, regardless of whether they have specific weaknesses.
- B. Incorrect.
Incorrect - Outdated software versions are not part of the attack surface; they are specific vulnerabilities. The attack surface refers to the collection of entry points, not the weaknesses within them.
- C. Correct.
Correct - Weak password policies are vulnerabilities because they are specific exploitable weaknesses in the system's security posture.
- D. Correct.
Correct - Outdated software versions are vulnerabilities because they represent specific weaknesses that attackers can use to compromise the system within the broader attack surface.